Description

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-21T21:17:00.267Z",
  "pubdate": "2026-08-21T21:17:00.267Z",
  "executiveSummary": "A critical vulnerability exists in the TensorZero Gateway prior to version 2026.6.0, specifically within the /internal/object_storage endpoint. The flaw stems from insufficient validation and sanitization of a caller-supplied JSON storage_path parameter that dynamically overrides the configured [object_storage] settings.\nBy manipulating this parameter, an attacker can leverage the filesystem storage type to read arbitrary files from the underlying gateway filesystem, including sensitive credential files. Alternatively, selecting the s3_compatible storage type forces outbound object-storage requests toward attacker-chosen internal resources or cloud-metadata endpoints, resulting in Server-Side Request Forgery (SSRF).\nThe impact of successful exploitation includes unauthorized disclosure of sensitive system files, potential credential theft, and internal network reconnaissance or cloud environment compromise. The vulnerability affects the TensorZero Gateway across deployments where the endpoint is exposed. Depending on the specific deployment configuration, exploitation may be achieved with or without authentication.\nRisk implications are high due to the exposure of infrastructure credentials and internal attack surface mapping capabilities. Mitigation requires upgrading the TensorZero platform to version 2026.6.0 or later, where the input validation and object storage configuration override logic has been appropriately secured.",
  "technicalDetails": "The vulnerability resides in the TensorZero Gateway component, specifically processing logic handling the /internal/object_storage endpoint prior to version 2026.6.0. The root cause of the flaw is the insecure design pattern that permits a caller-supplied JSON storage_path parameter to dynamically override internal application settings defined within the [object_storage] configuration block without strict parameter validation or allowlisting.\nExploitation is driven by the flexibility of the storage type selector within the payload. If an attacker submits a payload specifying the filesystem storage type, the gateway evaluates the attacker-controlled path, allowing traversal or absolute path references. This grants the attacker the ability to read arbitrary files accessible to the gateway process on the underlying filesystem, directly exposing sensitive assets such as application configuration files, private keys, and credential stores.\nIf the attacker configures the s3_compatible storage type within the storage_path parameter, the gateway interprets the destination as an S3-compatible object store and initiates outbound HTTP/HTTPS requests to the specified target. This behavior weaponizes the gateway to perform Server-Side Request Forgery (SSRF). Attackers can direct these outbound requests toward internal network services, loopback interfaces, or cloud provider metadata services (e.g., AWS IMDS), enabling internal port scanning, service enumeration, and credential harvesting via cloud metadata endpoints.\nThe attack flow proceeds as follows: First, the adversary identifies the network exposure of the TensorZero Gateway. Second, the adversary crafts a malicious JSON payload targeting the /internal/object_storage endpoint. Depending on the deployment configuration, this request may be submitted without authentication or using whatever access controls are active. Third, the payload injects the manipulated storage_path parameter. For file reading, the parameter references target system files. For SSRF, the parameter targets internal or cloud infrastructure endpoints. Finally, the gateway processes the request, either returning file contents within the application response or executing the unauthorized outbound request.\nPrerequisites for exploitation include network access to the TensorZero Gateway endpoint /internal/object_storage. Privilege requirements and authentication dependency vary based on the specific deployment configuration, ranging from completely unauthenticated access to authenticated sessions depending on edge proxy and gateway hardening implementations."
}